Configure network edge security policies

Network edge security policies let you configure rules to allow or block traffic at the edge of Google's network. You can configure network edge security policies for the following frontend types:

  • Regional external passthrough Network Load Balancers
  • Protocol forwarding
  • VMs with public IP addresses

You can use network edge security policies to filter by source and destination IP address ranges similarly to Cloud Next Generation Firewall but without consuming your resources. In addition, a network edge security policy is the only security policy type with support for byte offset filtering.

Configure custom rules for network edge security policies

Like backend and edge security policies, you can configure custom rules for network edge security policies. In the following example, you create a network edge security policy, configure a custom rule to allow traffic from only a given source IP address range, and attach the policy to your backend service.

Network edge security policies support several Google Cloud Armor filters, including unique filters like byte-offset filtering. For more information about what features network edge security policies support, see the security policy overview. In addition, you can deploy network edge security policies in preview mode.

Before you proceed, you must enroll in Google Cloud Armor Enterprise and configure advanced network DDoS protection. You cannot use custom rules for network edge security policies without an active Cloud Armor Enterprise subscription and advanced network DDoS protection.

To configure custom rules, follow these steps:

  1. Create a new network edge security policy with the name POLICY_NAME in the region REGION. Don't use the same security policy that you used when you enabled advanced network DDoS protection.

    gcloud compute security-policies create POLICY_NAME \
   --type=CLOUD_ARMOR_NETWORK \
   --region=REGION

  2. Change your policy's default rule from allow to deny to block traffic that is not explicitly allowed by other rules.

    gcloud compute security-policies rules update 2147483647 \
   --security-policy=POLICY_NAME \
   --action=deny \
   --region=REGION

  3. In the same security policy, add a rule at priority RULE_PRIORITY that allows requests in the source IP address range RANGE.